Null Pointer Dereference in Linux Kernel's USB Core - CVE-2024-26716
Summary
DEBIAN-CVE-2024-26716: In the Linux kernel, the following vulnerability has been resolved: usb: core: Prevent null pointer dereference in update_port_device_state Currently, the function update_port_device_state gets the usb_hub from udev->par... Affects linux versions < 6.7.7-1. Fixed in 6.7.7-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of many operating systems, providing essential services for hardware and software interaction. It is known for its robustness and versatility, supporting a wide range of devices and architectures. However, like any complex software, it is susceptible to vulnerabilities. This specific issue arises in the USB core functionality, which manages USB devices connected to the system.
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified in the USB core related to the function update_port_device_state. The function retrieves the usb_hub from udev->parent using usb_hub_to_struct_hub. If the actconfig or maxchild is set to 0, the usb_hub becomes NULL, leading to a null pointer dereference when attempting to access port_dev. This can cause system crashes or unexpected behavior, potentially impacting the stability and security of the system.
How To Fix
Minimum fixed version
6.7.7-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds provided for this vulnerability. The best course of action is to apply the patch as soon as it becomes available.
Conclusion
CVE-2024-26716 is a critical vulnerability in the Linux kernel's USB core that can lead to null pointer dereference issues, impacting system stability. Users are advised to update to the latest patched version to ensure their systems remain secure.
See every vulnerability recorded for linux →
FAQ
CVE-2024-26716 is a vulnerability in the Linux kernel's USB core that can lead to a null pointer dereference, potentially causing system crashes.
If exploited, this vulnerability can lead to instability in the system, affecting the performance and reliability of USB device management.
The vulnerability affects Debian 13 and 14 versions of the Linux package prior to version 6.7.7-1.
You can use Vulert, which monitors open-source vulnerabilities in real-time. Visit Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
While there are no specific workarounds, it is recommended to monitor the situation and apply the patch as soon as possible to mitigate risks.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
